topic Re: Global Protect SSO user id in General Topics

Global Protect SSO user id

markk96 — Thu, 09 Oct 2014 17:19:43 GMT

I have a portal and 3 gateways setup working with LDAP and active directory. It is setup to use user-logon with Single Sign On. All this works without issue. What I am having issues with is I have my firewalls intergrated with LDAP and Active directory groups, I use these groups for policy rules. What I am seeing, is that the Global Protect user will sometimes show only userid in the traffic logs, and not domain\userid, at some point it will switch to using domain\userid. This is causing me issues. Any thoughts?

Re: Global Protect SSO user id

bat — Thu, 09 Oct 2014 17:21:35 GMT

markk96

I have usually seen this issue when "Enable Server Session Read" is enabled and the user tries to access any resources such as printers etc. Can you check if it is enabled and try disabling it if possible ?

Hope it helps !

Re: Global Protect SSO user id

markk96 — Thu, 09 Oct 2014 17:22:49 GMT

Where is that setting?

Re: Global Protect SSO user id

bat — Thu, 09 Oct 2014 17:25:56 GMT

On the UserID agent or on the firewall (if Agentless)

Re: Global Protect SSO user id

markk96 — Thu, 09 Oct 2014 17:29:11 GMT

I have about 21 user id agents servers spread out across the globe, the default setting is set to 'NO' for Enable Server Session Read.

Re: Global Protect SSO user id

bat — Thu, 09 Oct 2014 17:35:47 GMT

Do you by any chance the same user in the local database on the firewall ?

Re: Global Protect SSO user id

markk96 — Thu, 09 Oct 2014 17:39:05 GMT

No local users configured.

Re: Global Protect SSO user id

bat — Thu, 09 Oct 2014 17:45:32 GMT

Also can you verify if domain name is correctly configured in server profile that you are using in the authentication profile for authentication in GP.

Re: Global Protect SSO user id

markk96 — Thu, 09 Oct 2014 17:54:52 GMT

In the ldap server profile I left the domain blank, but when do a show user user-ids match i get domain\user. I added the domain local name to the server profile. When I tested global connect the traffic logs showed the id without the domain, but then switched over to domain\user after about a minute. not sure if i just caught it on the cycle or not.

Re: Global Protect SSO user id

bat — Thu, 09 Oct 2014 18:00:10 GMT

markk96 Make sure it is the netbios domain name, to find out netbios domain name: How to Determine the NetBIOS Domain for LDAP Server Profile in Windows 2003 and 2008 Server

Re: Global Protect SSO user id

markk96 — Thu, 09 Oct 2014 18:01:23 GMT

I did put the netbios name in, so far so good. Thank you so much.